LeadsNearby Bulk Service Area Generator WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.1.1

Findings

2

Worst severity

high

Content hash

6583048c837fd5d029d5baaa… Copy

Findings

• high Bulk page creation on admin_init: nonce without capability check

  missing_capability

  add_pages() on admin_init creates published pages from POST after wp_verify_nonce('lnb-sag') only. No current_user_can. Menu capability is publish_posts, but any user who obtains a valid nonce (CSRF against Author+) can bulk-publish arbitrary page content/meta (SEO spam/stored XSS in content).

  lnb-service-area-generator.php:72-120

  Recommendation

  Require current_user_can('publish_posts') (or manage_options) in the handler; keep nonce.

• medium Post fields/meta taken from $_POST with minimal sanitization before publish

  unsafe_input

  get_post_fields/get_post_meta copy attacker-controlled post_fields and post_meta into wp_insert_post meta_input, including post_content, enabling stored HTML on newly published pages.

  lnb-service-area-generator.php:123-160

  Recommendation

  Allowlist field keys; sanitize post_content with wp_kses_post; restrict meta keys.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.